The Gold Standard · Anthropology
Make the decision path visible
A proxy-record appeal depends on more than a list of names. Its contact graph joins accountable roles, alternates, channels, authority and effect receipts. When the approved graph, directory, runbook and automated routing table no longer describe the same path, a notice can appear well addressed while the consequential decision remains unchanged.
The gold standard treats this version drift as a control problem: identify the authoritative graph, compare every operational copy, contain reliance on uncertain routes, repair stale alternates and prove that the corrected path still works when people and systems change.
Choose the route closest to your decision
Chapter contents
Chapters 1–3
Chapters 4–6
Chapters 7–9
Chapters 10–12
CHAPTER 1 OF 12 · DEFINE THE GRAPH
1. Treat the contact graph as a versioned record
The graph should identify the appeal decision point, accountable role, authorised delegate, independent alternate, channel, escalation timer and the receipt that proves an operational effect. Give the whole graph a version, effective time and owner.
A spreadsheet, directory entry and automated rule are not separate truths. They are implementations of one authorised route, and each needs a traceable relationship to the version that approved it.
CHAPTER 2 OF 12 · DEFINE THE GRAPH
2. Distinguish version drift from temporary unavailability
Version drift exists when two supposedly current representations disagree about a node, edge, authority or effective date. Temporary unavailability occurs when the correct route exists but cannot respond for a bounded period.
The distinction matters. A transient outage may call for an alternate; drift requires reconciliation because retrying can preserve the wrong recipient or obsolete authority.
Evidence check
Check whether the scope, owner and decision consequence are explicit before continuing.
CHAPTER 3 OF 12 · DEFINE THE GRAPH
3. Choose an authoritative source without hiding local reality
Name the register that approves contact-graph changes and the systems that consume it. Preserve local exceptions, timestamps and sync failures instead of overwriting them silently.
Authority does not mean assuming the register is correct. If operational evidence shows that the approved owner left or cannot act, flag the conflict and suspend consequential reliance until it is resolved.
| Element | Required evidence |
|---|---|
| Graph | Version and effective time |
| Node | Current role and authority |
| Edge | Channel and dependency |
| Receipt | Operational state changed |
CHAPTER 4 OF 12 · FIND STALE ROUTES
4. Compare nodes, edges and authority
Reconcile role identifiers, people, aliases, alternates, shared dependencies, escalation order, time zones and action rights. Check both the value and when it became effective.
A matching email address can conceal drift when its forwarding target or role permissions changed. An apparently different alternate can still share the same failed mailbox or approver.
CHAPTER 5 OF 12 · FIND STALE ROUTES
5. Set materiality and recurrence triggers
Escalate when drift affects the final decision point, two independent routes converge, an alternate is past review, a sync job fails, ownership changes without acknowledgement or a repaired edge fails again.
Not every formatting difference is material. Record harmless discrepancies, but prioritise conflicts that can delay revocation, misdirect protected information or leave stale authority in force.
Evidence check
Ask a second reviewer to reconstruct the example from the preserved evidence and stated assumptions.
CHAPTER 6 OF 12 · FIND STALE ROUTES
6. Worked example: a panel alternate survives in the wrong version
A community panel replaces its secretary and approves a new duty-role address. The appeal register records version 18, but the automated notice job still reads a cached version 16. Its alternate points to a deputy who also left. A revocation message is marked sent, yet neither current role receives it.
The appeal owner pauses closure, identifies version 18 as approved, verifies the new duty route independently, removes the stale shared dependency and requires an effect receipt from the registry. Changed-context check: if version 18 is deployed everywhere but the duty mailbox is temporarily offline and a genuinely independent phone escalation completes the change, the incident is availability loss rather than version drift.
| Comparison | Failure signal |
|---|---|
| Register to directory | Different owner |
| Directory to router | Old alias cached |
| Primary to alternate | Shared dependency |
| Notice to effect | No state change |
CHAPTER 7 OF 12 · REPAIR SAFELY
7. Contain decisions while the route is uncertain
Mark the appeal record, stop automatic closure and limit only decisions that depend on the disputed notification. Preserve messages, routing logs, directory snapshots and configuration versions.
Containment should be proportionate. A stale alternate does not justify freezing unrelated panel work when its decisions do not rely on the contested proxy record.
CHAPTER 8 OF 12 · REPAIR SAFELY
8. Synchronise through an explicit change transaction
Approve the new graph, assign an effective time, update each consuming system, invalidate caches and obtain acknowledgements from consequential owners. Record failures rather than treating partial deployment as complete.
Use idempotent change identifiers where possible so retries do not create conflicting versions. Keep the previous graph available for comparison, not for ordinary routing.
Evidence check
Verify that the control still reaches the intended decision under a changed but plausible context.
CHAPTER 9 OF 12 · REPAIR SAFELY
9. Reconcile the drift window
Find notices and decisions processed between the first divergence and verified repair. Determine which used the stale edge, whether the intended authority was reached and whether any outcome needs reconsideration.
A drift window is not proof that every decision failed. Preserve stable outcomes when evidence shows the correct owner acted through another valid route.
| Step | Control |
|---|---|
| Approve | Named authority |
| Deploy | All consumers listed |
| Acknowledge | Consequential owners |
| Close | Effect receipt verified |
CHAPTER 10 OF 12 · PREVENT RECURRENCE
10. Exercise the graph at predictable change points
Test staff departure, role rename, directory migration, contractor exit, after-hours escalation and restoration from backup. Confirm that version, authority and effect receipts stay aligned.
Tie tests to actual change events as well as a review calendar. A yearly check cannot catch a role transfer that breaks the route tomorrow.
CHAPTER 11 OF 12 · PREVENT RECURRENCE
11. State what a synchronised graph cannot prove
Matching versions do not prove that a recipient understood the notice, held practical authority or completed the change. A successful test does not prove every downstream copy was reached.
State these limits beside the evidence. The control claims a maintained path to consequential action, not perfect availability or universal human response.
Evidence check
Confirm that versions, notices and unresolved limits remain visible in the final record.
CHAPTER 12 OF 12 · PREVENT RECURRENCE
12. Audit drift as a recurring control risk
Track version mismatches, stale alternates, shared dependencies, failed syncs, time to containment, unacknowledged changes, repeated repair and decisions inside exposure windows.
The gold standard makes contact-graph freshness observable. Recurrence prevention rests on ownership, event-driven updates, independent alternates and evidence that the repaired route changes the right state.
| Measure | Warning |
|---|---|
| Mismatch age | Silent exposure |
| Stale alternates | False resilience |
| Sync retry | Partial deployment |
| Repeat edge failure | Repair not durable |
Frequently asked questions
Is a bounced message always contact-graph drift?
No. Confirm whether the route is obsolete or merely unavailable; drift is disagreement about the current authorised path.
Which copy should be authoritative?
Use the register designated to approve graph changes, while treating contrary operational evidence as a conflict that must be resolved rather than overwritten.
Should the old graph be deleted after repair?
Preserve it for audit and exposure-window analysis, but remove it from ordinary execution and label its superseded status.
How is recurrence prevented?
Connect updates to real change events, verify every consumer, test independent alternates and audit repeat failures against the same consequential edge.
Continue through verified routes
Core routes
Anthropology subject root · Gold Standard of Education · Gold Standard directory · How X Works hub
Specialist routes
- Dead-letter recovery recurrence, broken contact graphs and notification resilience
- Revocation propagation failure modes, dead-letter notices and recovery ownership
- Revocation-chain gaps, orphaned delegates and authoritative closure
- Acknowledgement revocation propagation, downstream delegation chains and closure reconciliation